- cypherpunks-legacy - lists.cpunks.org

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- First of all, let me apologize for not being very knowledgable about CA's and https and SSLeay, apache, and generating renegade (ie, your own) certificates. If someone wants to go over this [again] certainly it'd be welcome. I was today playing around with a Mozilla 2.0beta5 that someone gave me [more bells and whistles than my 1.12, but not much more bang for the buck] and was showing a friend all the nifty information that netscape tells about you when you visit sites, then went to c2 to show off the apache web server and when I tried to use https:// to show off how you can have your own encrypting web server for free and everything, a window popped up and said the certificate was expired. I couldn't really tell if it meant that the certificate that Sameer generated really needed to be updated, or if Netscape beta 5 had just been rigged to reject non-netscape certificates, but the end result was no encryption. (Jeff, if you're reading this, of course we know that Netscape, with it's open loving policies wouldn't do anything underhanded, but the thought does come to mind, and by the way, when are we going to see an option to turn off or control what information is passed out to the other end. Specifically, I'd like http://anonymizer.cs.cmu.edu:8080/prog/snoop.pl to come up nearly blank.) Soooo, anyway, I was wondering if anyone knows anything about the use of privately generated certificates. Yes, Jeff, we know that Netscape is jumping to fully support user-specified certificates, but personally I saw, relating to certificates, a lot of *nifty* options and displays, but really didn't see much in the way of anything that looked like "add". ...Looking forward to the day where end-to-end encryption is king, and the TLA, my competition, or anyone else can take their packet sniffer and kiss my butt. Don PS: my predictions on the PRZ-secretly-sold-out-rumor-index: 6. my predictions on the IQ of those making those claims: 6. (cumulative) woohooo Phil! - -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company * -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMPXDV8La+QKZS485AQHkXwMAnGWVeLB6ntpkK1ksZ7a8+iklA/sPfIT2 XqqJRRX0Ddg2UuAAxmk6WOC/nxnRPRlM/4AkkaEohZRv14ccnlvv3qVGFxpLlxKG iYgbn1x9/xgHjwAB31HqozQix79wPfB/ =v9ni -----END PGP SIGNATURE-----

1 0

What Jim Choate doesn't know
by Anonymous 17 Dec '03

17 Dec '03

When Jim Choate writes about something that I know about, he is usually wrong. Look at the hash he made of quantum mechanics recently. And don't get me started on his blunders regarding cryptography. So when he writes about something I don't know about, like the EM emissions of video tubes, I tend to assume the same thing. He's probably all messed up. Anybody else have the same experience? And how about his countless off-topic posts, forwarding all kinds of pointless crap? Is anyone else sick of that, too?

2 1

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

The other day I was poking around lists of open NNTP servers, and came across something odd at llyene.jpl.nasa.gov . It appears that nothing has ever been expired there. Some groups had hundreds of thousands of messages. This might be interesting and useful for some purposes. Anyone know if that's where Dave Hayes does his amazing administrative thing?

1 0

No Subject
by Mario Enrique Sanchez 17 Dec '03

17 Dec '03

Can i be subscribed to the list?

1 0

Microsoft's papers on NT C2 thang
by Rich Graves 17 Dec '03

17 Dec '03

[Oops, signature is only valid if the > 80 column line is preserved] -----BEGIN PGP SIGNED MESSAGE----- I'd appreciate it if someone could critique these papers for me, probably off the list. [Note that 198.105.232.5 is just one of the IP addresses being load-balanced by www.microsoft.com. The servers seem to crash a lot with the current Gibraltar beta, so if one IP address doesn't work (like .5 isn't responding to pings right now), try another and it will work.] - -rich - ---------- Forwarded message ---------- Date: 12 Jan 1996 11:22:38 -0600 From: Richard P. Bainter <pug(a)arlut.utexas.edu> Newgroups: comp.security.misc, alt.security, comp.os.ms-windows.networking.misc, comp.os.ms-windows.networking.windows, comp.os.ms-windows.nt.admin.networking Subject: Re: Microsoft continues to mislead public about Windows security bugs (a bit long, with references) In article <t6d9w0JfFigb089yn(a)oslonett.no>, Rune Moberg <mobergru(a)oslonett.no> wrote: >>This is true. In fact NT was never C2-certified as any kind of network >>server at all, but only as a standalone workstation. >I read a statement made by MS, that it doesn't matter, because if NT is >proved to be C2 secure in a standalone configuration, then it's secure >on the network as well. You believe everything MS tells you?! How naive. >C2 security, AFAIK, also requires that the server is protected (controlled >access). Once you have physical access to a machine, you could open it, >put in a floppy or hard drive, and access anything you'd like to on the >machine in question (with a disk editor, or with a fresh installation of >the OS in question). Atleast that's the only way I can think of to break in >on a NT Server. Otay, let me see. The server is protected if you aren't hooked up to a network. That implies *nothing* about the fact when a network is plugged into it. If I'm sitting at the console and have to enter a password to do things, doesn't mean I have to enter one from the network when I mount the entire disk. (Even if that is not the true case.) There are orange, red and blue books. This is all well pointed out on: http://www.windows.microsoft.com/TechNet/boes/bo/winntas/technote/security.… What has Microsoft actually passed? I had heard it was only Orange book C2 and not Red book C2. Micrsoft also points it out on: http://198.105.232.5/NTServer/c2bltn.htm Ciao, - -- Richard Bainter Mundanely | OS Specialist - OMG/CSD Pug Generally | Applied Research Labs - U.Texas pug(a)arlut.utexas.edu | pug(a)eden.com | {any user}(a)pug.net Note: The views may not reflect my employers, or even my own for that matter. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPcRpI3DXUbM57SdAQFbWgP9HrpdsuC/p3iURubYobgXRXlvlmrRgJot 5kDBCOrDHRtyjXQj7n0CLU6TsEpTLR2ZfTGNUrKoc2lE1q0+PSzF4WpOyywNKULw StB8d+0n0NPuN2Bcbb7mO0M0VbE9khL5CYrcfWB5FR6JPfXU18cfSTXCROgGu4U9 ASvbxOkVLeM= =L7so -----END PGP SIGNATURE-----

1 0

Offshore Banks and Asset Protection
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:57 PM 1/12/96, Rich Graves wrote: >Every issue of The Economist (and I'm sure lots of other publications) >has ads for this kind of thing. > >Anyone know a reference for ranking the "legitimacy" of these services >and seminars? I'd assume that many of them are scams that will gladly >take your money overseas, but you might never see it again. > >Probably follow up offline, because cpunk relevance is a bit tenuous. I'll follow up on the list, because it's a topic of interest (or curiousity) to several, and I favor writing for the list. I looked into "asset protection" [see note below] using offshore banks (Carribean, Channel Islands, Europe, etc.), and bought a couple of books on this. And I subscribed to some Net newsletters. I'm not an expert, and have not chosen (yet) to "protect" my assets by moving them offshore. I think the assumption that most of the ads in the back of "The Economist" are scams which will take your money is wrong. The banks will take your money, but most probably will return it on demand. And the seminar companies will in fact teach some things. However, they may be "scams" in a gentle sense: they won't provide easy solutions that many of us will feel fully comfortable with. By this I mean that one is hit with dozens of competing claims, by reports that the IRS and FinCen are infiltrating these banks, that treaty negotiations will soon close these tax havens, and all sorts of stuff like this. Things which do not inspire confidence. (In fact, the report that these back-of-the-Economist ads are "scams" is perhaps part of this disinformation/rumor campaign.) Like a lot of things, it may all be clearer once one has actually gone ahead and done something with these offshore banks. I don't personally know anyone who has, which adds to my uncertainty. [Note: Many advisors call their schemes "asset protection," rather than "tax sheltering" (or "tax evasion"). The idea is to put assets beyond the reach of tort judgments. For example, a doctor may fear the incredibly large "deep pockets" lawsuits that American society encourages, so he transfers a large fraction of his net worth to an offshore bank. He reports income from these assets to the IRS, so he is not a tax evader, just someone who has partially "judgment-proofed" himself (to use the term Duncan and Sandy use). This is not illegal, currently. Lots of issues to consider.] --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re:NSA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMPVGgyoZzwIn1bdtAQG/1wGAwFELRklL0jv58QWSXMg8Z+OUNPX1OtXJ UaI51iIBh2IjH1hggHtyMUi1B6xrlbmo =h/+n -----END PGP SIGNATURE-----

1 0

PGP_foi
by John Young 17 Dec '03

17 Dec '03

1-12-96. NYPaper: "Data Secrecy Export Case Dropped by U.S." By John Markoff. PGP_foi

1 0

RE: Cyber 'Nannys"
by WebWarrior3＠InfoWar.Com 17 Dec '03

17 Dec '03

An anonymous person wrote, in reference to CyberSitter type 'blocking' software: "These companies are attempting to provide the services desired by their customers... They give concerned parents a sense of safety..." While I do not disagree that these companies should be able to market their products, I wholeheartedly disagree with the fact that often their customers (the adults who bought the software or subscribed to he 'service') are not allowed to have a list of what is actually blocked, and decide for themselves if they want their kids to have access to any of these sites. It would be beating a dead horse to describe, here, the potential value of some of the information that is blocked by these packages; one only has to take a look at any of the published news reports (or actually use one's sense of reason) to see that there are many web sites that contain some of the words that are automatically bloked by these 'services' that are absolutely not...smut <for lack of a better term>, hate speech, or illegal/illicitly oriented. On another, perhaps more severe (to you, Anonymous poster,) angle, they DO NOT, NOR CAN THEY provide a genuine saftey zone for the children who are to be 'protected.' They are providing a false sense of security to parents who, for one reason or another, feel that they are not able to provide their children with direction on what to, and what not to, view on the internet as well as what to do if the instance arises that something that is deemed taboo happens to pop up on their monitor when they click on the 'Chutes and Ladders' web site <for example, I don't know if there is one...trying to be safe and guess that there is not>. I am assuming that there is no latent support for the use of these packages in public libraries, so I won't go into that issue. In general, these programs are flat out crap. They purport to do something that is impossible to accomplish and they often refuse to even inform their customers what they actually ARE doing. Scott R. Brower http://www.infowar.com http://www.efflorida.org

5 11

E-cash and Interest
by Frank O. Trotter, III 17 Dec '03

17 Dec '03

Once the Ecash Mint and the account (in our case the WorldCurrency Access account - others will be different) are merged, the balance you hold in the Mint may be able to earn interest. Like an individual, the amount of interest offered will involve a cost benefit relationship based on cost of funds, regulation, and operational costs, but there should be no obvious reason not to pay something in most curencies. One note, under US banking regulation, "transaction accounts" fall under different rules than money market accounts, savings accounts, and NOW accounts. Depending on the exact functionality desired, and future regulation changes, there will be more or less incentive and/or legal ability to pay interest. Given the current functionality of Ecash there will be little incentive to hold balances on your hard drive once interest is available. It is just too easy to move the money down when you need it. Today there is no specific cost incentive between the Mint and your hard drive. It does not take a long leap to see that when the account and the Mint are merged, that since the Mint _is_ the account, PC/Internet banking, debit and all other regular banking functionality can become immediately integrated! Frank Trotter ftrotter(a)marktwain.com Opinions expressed are my own.... > On Wed, 10 Jan 1996, Tim Philp wrote: > > > With the E-cash systems that I have seen, you generate your own E-cash > > and have it signed by a 'bank' At that moment, it becomes like cash in > > your wallet and you loose interest that this money could be earning. > > >From the standpoint of monetary economics, this is correct. The (ecash) > bank has the right to use your deposits to give out loans. When you > withdraw your money (and turn it into either cash or ecash) they (the > bank) no longer have the right to turn your deposits into loans. > Withdrawn cash/ecash can not earn interest. > > This is the problem of (e)cash: if you have it on hand you _must_ forgo > any interest earnings. Theoretically, the optimum holding of (e)cash is a > function of interest rate (the greater the interest rate, the less cash on > hand), transaction cost of making withdrawals (the easier and more > convenient the withdrawals, the less cash on hand), and the "providence > value" of cash (the more you value instant gratification, the more cash on > hand). > > Thats why ATM machines have caused us to hold less cash. We can now keep > money in the bank (letting it earn interest and letting the bank create > loans with it) and withdraw from ATM terminals only when we need it. > > ------------------------------------------------------------------------------- > Patiwat Panurach Whatever you can do, or dream you can, begin it. > eMAIL: pati(a)ipied.tu.ac.th Boldness has genius, power and magic in it. > m/18 junior Fac of Economics -Johann W.Von Goethe > -------------------------------------------------------------------------------

2 1